E-mail security risks: taking hacks at the attorney-client privilege.

• Author: Rose, Jonathan

1. INTRODUCTION

   The emergence of electronic mail ("e-mail") as a commonplace form of communication has been accompanied by an equally commonplace debate regarding the medium's security.(1) Given the vulnerability of e-mail systems to the threat of hackers, it is difficult for an e-mail user to remain confident in the security of electronic communications. This debate is particularly germane to attorneys acting within the ambit of the attorney-client privilege. Participants in this security debate have expressed attitudes ranging from anxiety(2) to a confident lack of concern.(3)

   Attorneys who wish to use e-mail to communicate with clients should consider the degree of security it offers and its implications for the attorney-client privilege.(4) E-mail communications become computerized records when saved and are subject to discovery requests during litigation.(5) E-mail is also subject to discovery if the privilege is unintentionally waived through a failure to maintain confidentiality.(6) Thus, waiver is possible where e-mail does not offer sufficient security.

   This Note addresses the largely unexplored issue of whether e-mail is secure enough to preserve the attorney-client privilege in a situation where an e-mail communication is unintentionally disclosed to a third party. E-mail security turns upon many factors, including the size of the network used, the servers and software employed, whether the communication is en route or in storage, and, perhaps most importantly, the attractiveness of the client and the firm to eavesdroppers ("hackers"). Maintenance of the attorney-client privilege rests on a reasonableness standard. All of the above factors should be considered in applying the privilege to e-mail. Furthermore, given e-mail's efficiency and convenience,(7) determinations regarding waiver of the privilege should not be so strict as to effectively prohibit its use by attorneys and their clients.

   Section II of the Note provides background regarding the attorney-client privilege necessary to apply the privilege to e-mail. Section III applies the privilege to e-mail and suggests standards that courts might use to determine outcomes in various situations. Section IV presents a survey reflecting the views of law firms concerning the risks of e-mail.

2. BACKGROUND

   1. The Attorney-Client Privilege

      The attorney-client privilege protects communications between attorneys and their clients from disclosure.(8) The purpose of the privilege, as set forth by the United States Supreme Court in Upjohn Co. v. United States,(9) is "to encourage full and frank communication between attorneys and their clients."(10) The public's interest in sound legal assistance depends upon clients' willingness to fully inform their attorneys(11) without the consequences or fear of disclosure.(12) The privilege is strictly construed because it may have the side effect of acting as "an obstacle to the investigation of the truth."(13)

      1. Elements of the Attorney-Client Privilege

         The essential elements of the attorney-client privilege are as follows:

         1) Where legal advice of any kind is sought

         2) from a professional legal adviser in his capacity as such,

         3) the communications relating to that purpose,

         4) made in confidence

         5) by the client,

         6) are at this instant permanently protected

         7) from disclosure by himself or by the legal adviser,

         8) unless the protection be waived.(14)

         The privilege extends to an attorney's advice in response to a client's communication,(15) protecting against disclosure of communications, but not against disclosure of the facts underlying the communications.(16) The party asserting the privilege must prove that the privilege applies to the communication.(17)

         In applying the attorney-client privilege to e-mail, this Note proposes that the most crucial elements to consider are the requirements that the communications be confidential and that the privilege has not been waived.(18) The remainder of this section of the Background will outline the significant trends in case law concerning these elements. These trends will later be applied to the e-mail medium. To simplify matters, unless otherwise noted, the communications discussion will be limited to communications from the client to the attorney.

      2. The Confidentiality Requirement

         The attorney-client privilege protects communications that are "intended to remain confidential, and [are] made under such circumstances that [they are] reasonably expected and understood to be confidential."(19) Furthermore, confidentiality must be continually maintained even after the communication is sent.(20) The tests used to assess the expectation of confidentiality--the subjective and objective tests--are closely related factual questions(21) generally resolved through consideration of the client's purpose in communicating with the attorney (i.e., whether the communication was also intended for a third party outside the attorney-client relationship),(22) and the circumstances surrounding each communication (i.e., whether it is made in the presence of, or is disseminated to, third parties).(23)

         Subjective expectations of confidentiality can be determined by examining the client's expressed intentions, the circumstances surrounding the communication,(24) as well as the client's subsequent efforts to maintain the communication's confidentiality.(25) The mere fact that a communication was initiated by a client to an attorney is insufficient to fulfill this requirement; there must be an indication of an intention to maintain secrecy.(26) Failure to mark a communication "confidential" may indicate that the sender did not anticipate confidentiality, but this alone is not dispositive.(27) Wide dissemination of a communication is also not dispositive.(28) If the client intends a communication to be disseminated to a third party, courts will find the privilege destroyed, regardless of whether or not the communication reaches the third party.(29)

         The "objective test," i.e., whether a client's anticipation of confidentiality was reasonable, is a determination generally based on the circumstances surrounding the communication.(30) The factual circumstance which most commonly impacts upon the determination is the presence of a third party at the time of the communication.(31) An expectation of confidentiality is generally unreasonable in situations where a third party is present who is neither an agent of the client or the attorney,(32) a joint client,(33) nor a participant in a joint or common defense.(34) This rule holds true even when the third party is "casual" and "disinterested."(35)

         The determination of what circumstances constitute "in the presence of third parties" is essential to an objective test analysis. For instance, in In re Sealed Case,(36) the privilege was held to apply to a conversation between an attorney and a client who were sitting next to each other in the first-class section of an airplane and "speaking in tones not likely to be overheard."(37) The privilege was held to be inapplicable in another case where the client had his accountant deliver documents to his attorney; the accountant himself could have examined the documents.(38) Generally, when a client seeks legal services with the expectation that the attorney will relay the client's communication to others, the client can have no reasonable expectation of confidentiality.(39)

         Analyses of the circumstances surrounding communications under the subjective and objective tests often merge; courts have assumed subjective expectation is lacking where such expectation would have been objectively unreasonable.(40) Some courts focus on neither test, and instead look to whether the communications were, in fact, confidential or whether they were inaccessible to third parties.(41)

      3. Waiver o the Privilege

         The attorney-client privilege applies only if it has not been waived. The privilege can be waived by the client or an agent of the client authorized to do so, including the client's attorney.(42) In Commodity Futures Trading Commission v. Weintraub,(43) the court held that if the client is a corporation, authority to waive the privilege is generally limited to the corporation's "control group," comprised of corporate officers and directors.(44) This rule regarding corporations remains true despite the fact that the privilege's protection can extend to the communications of other employees. In Upjohn Co. v. United States,(45) the Supreme Court held that employees' communications were protected where: (1) employees made them at the direction of superiors; (2) the communications concerned matters within the scope of the employees' corporate duties; and (3) the employee was aware of the legal context of the communication.(46) The court determined that employee communications containing information unavailable from upper-echelon management, and yet necessary to "supply a basis for legal advice," were protected by the attorney-client privilege.(47)

         As another consideration, in Jonathan Corp. v. Prime Computer, Inc.,(48) the court held that an employee outside the "control group" can waive the privilege through voluntary disclosure of a communication.(49) Jonathan Corp. narrowly interpreted Weintraub as applying only to a corporation in bankruptcy; the court noted that a corporation whose noncontrol group communications benefit from the privilege's protection under Upjohn must accept the risk that a noncontrol group employee will waive the privilege.(50) The employee in Jonathan Corp. was in a position to voluntarily disclose the communication, and the corporation failed to take precautions necessary to preserve confidentiality.(51)

         A client can waive the privilege expressly(52) although, more commonly, waiver is implied(53) through conduct that is inconsistent with a reasonable claim of confidentiality, making extension of the privilege unfair.(54) Both the client(55) and the attorney(56) can destroy the confidentiality...